From f8fd0422bff05269d3e876b79dc746427a0a671a Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 25 Sep 2024 09:16:22 -0700
Subject: [PATCH 01/64] uncomment test code

---
 ...est_send_message_from_existing_template.py | 108 +++++++++---------
 1 file changed, 55 insertions(+), 53 deletions(-)

diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index 302004c76..3a9289120 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -174,39 +174,39 @@ def handle_no_existing_template_case(page):
     check_axe_report(page)
 
     # TODO staging starts failing here, fix.
-    # dashboard_button = page.get_by_text("Dashboard")
-    # expect(dashboard_button).to_be_visible()
-    # dashboard_button.click()
+    dashboard_button = page.get_by_text("Dashboard")
+    expect(dashboard_button).to_be_visible()
+    dashboard_button.click()
 
     # Check to make sure that we've arrived at the next page.
 
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-    # download_link = page.get_by_text("Download")
-    # expect(download_link).to_be_visible()
+    download_link = page.get_by_text("Download")
+    expect(download_link).to_be_visible()
 
     # Start waiting for the download
-    # with page.expect_download() as download_info:
-    # download_link.click()
-    # download = download_info.value
-    # download.save_as("download_test_file")
-    # f = open("download_test_file", "r")
+    with page.expect_download() as download_info:
+        download_link.click()
+        download = download_info.value
+        download.save_as("download_test_file")
+        f = open("download_test_file", "r")
 
-    # content = f.read()
-    # f.close()
-    # We don't want to wait 5 minutes to get a response from AWS about the message we sent
-    # So we are using this invalid phone number the e2e_test_user signed up with (12025555555)
-    # to shortcircuit the sending process.  Our phone number validator will insta-fail the
-    # message and it won't be sent, but the report will still be generated, which is all
-    # we care about here.
-    # assert (
-    #  "Phone Number,Template,Sent by,Batch File,Carrier Response,Status,Time"
-    #  in content
-    # )
-    # assert "12025555555" in content
-    # assert "one-off-" in content
-    # os.remove("download_test_file")
+        content = f.read()
+        f.close()
+        # We don't want to wait 5 minutes to get a response from AWS about the message we sent
+        # So we are using this invalid phone number the e2e_test_user signed up with (12025555555)
+        # to shortcircuit the sending process.  Our phone number validator will insta-fail the
+        # message and it won't be sent, but the report will still be generated, which is all
+        # we care about here.
+        assert (
+            "Phone Number,Template,Sent by,Batch File,Carrier Response,Status,Time"
+            in content
+        )
+        assert "12025555555" in content
+        assert "one-off-" in content
+        os.remove("download_test_file")
 
 
 def handle_existing_template_case(page):
@@ -287,44 +287,46 @@ def handle_existing_template_case(page):
 
     send_button = page.get_by_role("button", name="Send")
     expect(send_button).to_be_visible()
-    # send_button.click()
+    send_button.click()
 
     # Check to make sure that we've arrived at the next page.
-    # page.wait_for_load_state("domcontentloaded")
+    page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
 
-    # dashboard_button = page.get_by_text("Dashboard")
-    # expect(dashboard_button).to_be_visible()
-    # dashboard_button.click()
+    dashboard_button = page.get_by_text("Dashboard")
+    expect(dashboard_button).to_be_visible()
+    dashboard_button.click()
 
     # Check to make sure that we've arrived at the next page.
-    # page.wait_for_load_state("domcontentloaded")
+    page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
 
-    # download_link = page.get_by_text("Download")
-    # expect(download_link).to_be_visible()
+    download_link = page.get_by_text("Download")
+    expect(download_link).to_be_visible()
 
     # Start waiting for the download
-    # with page.expect_download() as download_info:
-    # Perform the action that initiates download
-    #    download_link.click()
-    # download = download_info.value
-    # Wait for the download process to complete and save the downloaded file somewhere
-    # download.save_as("download_test_file")
-    # f = open("download_test_file", "r")
+    with page.expect_download() as download_info:
+        # Perform the action that initiates download
+        download_link.click()
+        download = download_info.value
+        # Wait for the download process to complete and save the downloaded file somewhere
+        download.save_as("download_test_file")
+        f = open("download_test_file", "r")
 
-    # content = f.read()
-    # f.close()
-    # We don't want to wait 5 minutes to get a response from AWS about the message we sent
-    # So we are using this invalid phone number the e2e_test_user signed up with (12025555555)
-    # to shortcircuit the sending process.  Our phone number validator will insta-fail the
-    # message and it won't be sent, but the report will still be generated, which is all
-    # we care about here.
-    # assert (
-    #    "Phone Number,Template,Sent by,Batch File,Carrier Response,Status,Time"
-    #    in content
-    # )
-    # assert "12025555555" in content
-    # assert "one-off-e2e_test_user" in content
-    # os.remove("download_test_file")
+        content = f.read()
+        f.close()
+        # We don't want to wait 5 minutes to get a response from AWS about the message we sent
+        # So we are using this invalid phone number the e2e_test_user signed up with (12025555555)
+        # to shortcircuit the sending process.  Our phone number validator will insta-fail the
+        # message and it won't be sent, but the report will still be generated, which is all
+        # we care about here.
+        assert (
+            "Phone Number,Template,Sent by,Batch File,Carrier Response,Status,Time"
+            in content
+        )
+        assert "12025555555" in content
+        assert "one-off-e2e_test_user" in content
+        os.remove("download_test_file")
 
 
 def test_send_message_from_existing_template(authenticated_page):

From 250a36836d2a9d490a6c42a78209175b98fcf64b Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 25 Sep 2024 09:29:50 -0700
Subject: [PATCH 02/64] fix

---
 .../test_send_message_from_existing_template.py     | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index 3a9289120..c05e7aac3 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -174,16 +174,19 @@ def handle_no_existing_template_case(page):
     check_axe_report(page)
 
     # TODO staging starts failing here, fix.
-    dashboard_button = page.get_by_text("Dashboard")
-    expect(dashboard_button).to_be_visible()
-    dashboard_button.click()
+    print(page)
+    print(page.content)
+    activity_button = page.get_by_text("Activity")
+    expect(activity_button).to_be_visible()
+    activity_button.click()
 
     # Check to make sure that we've arrived at the next page.
 
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
-
-    download_link = page.get_by_text("Download")
+    print(page)
+    print(page.content)
+    download_link = page.get_by_text("Download all data last 7 days (CSV)")
     expect(download_link).to_be_visible()
 
     # Start waiting for the download

From ddd413f2995a8e71b110a6eb1f97df5d9bfa83da Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 25 Sep 2024 09:38:59 -0700
Subject: [PATCH 03/64] fix

---
 .../test_send_message_from_existing_template.py           | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index c05e7aac3..451ecc3c2 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -174,8 +174,8 @@ def handle_no_existing_template_case(page):
     check_axe_report(page)
 
     # TODO staging starts failing here, fix.
-    print(page)
-    print(page.content)
+    print(f"SHOULD BE SEND PAGE: {page}")
+    print(page.content())
     activity_button = page.get_by_text("Activity")
     expect(activity_button).to_be_visible()
     activity_button.click()
@@ -184,8 +184,8 @@ def handle_no_existing_template_case(page):
 
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
-    print(page)
-    print(page.content)
+    print(f"SHOULD BE ACTIVITY PAGE: {page}")
+    print(page.content())
     download_link = page.get_by_text("Download all data last 7 days (CSV)")
     expect(download_link).to_be_visible()
 

From a088409dfeba315d3719e9e6d147ddf96cd75b0f Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 25 Sep 2024 09:54:31 -0700
Subject: [PATCH 04/64] fix

---
 tests/end_to_end/test_send_message_from_existing_template.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index 451ecc3c2..b64160ae0 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -164,6 +164,8 @@ def handle_no_existing_template_case(page):
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
+    print(f"SHOULD BE PREVIEW PAGE: {page}")
+    print(page.content())
 
     send_button = page.get_by_role("button", name="Send")
     expect(send_button).to_be_visible()

From fd2de9bf9bd148f9f91b5f3662a1524cc200aa57 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 08:44:10 -0700
Subject: [PATCH 05/64] more debug

---
 .github/workflows/checks.yml | 1 +
 Makefile                     | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8fa950942..1b78186e5 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -99,6 +99,7 @@ jobs:
         # above make e2e-test
         run: |
           make run-flask > admin-server.log 2>&1 &
+          tail -f admin-server.log &
           make e2e-test
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
diff --git a/Makefile b/Makefile
index ed9baf394..90e8e76de 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ dead-code: ## 60% is our aspirational goal, but currently breaks the build
 .PHONY: e2e-test
 e2e-test: export NEW_RELIC_ENVIRONMENT=test
 e2e-test: ## Run end-to-end integration tests; note that --browser webkit isn't currently working
-	DEBUG=pw:api,pw:browser poetry run pytest -vv --browser chromium  --browser firefox tests/end_to_end
+	poetry run pytest -vv --browser chromium  --browser firefox tests/end_to_end
 
 .PHONY: js-lint
 js-lint: ## Run javascript linting scanners

From 3967612eb1f79fdd517f483dfe1b53c3c272d5a1 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 08:53:40 -0700
Subject: [PATCH 06/64] more debug

---
 Makefile                                                     | 2 +-
 tests/end_to_end/test_send_message_from_existing_template.py | 3 ---
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/Makefile b/Makefile
index 90e8e76de..59b2a6e0d 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ dead-code: ## 60% is our aspirational goal, but currently breaks the build
 .PHONY: e2e-test
 e2e-test: export NEW_RELIC_ENVIRONMENT=test
 e2e-test: ## Run end-to-end integration tests; note that --browser webkit isn't currently working
-	poetry run pytest -vv --browser chromium  --browser firefox tests/end_to_end
+	poetry run pytest -vv --browser chromium tests/end_to_end/test_send_message_from_existing_template.py
 
 .PHONY: js-lint
 js-lint: ## Run javascript linting scanners
diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index b64160ae0..d52a3c1df 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -165,7 +165,6 @@ def handle_no_existing_template_case(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
     print(f"SHOULD BE PREVIEW PAGE: {page}")
-    print(page.content())
 
     send_button = page.get_by_role("button", name="Send")
     expect(send_button).to_be_visible()
@@ -177,7 +176,6 @@ def handle_no_existing_template_case(page):
 
     # TODO staging starts failing here, fix.
     print(f"SHOULD BE SEND PAGE: {page}")
-    print(page.content())
     activity_button = page.get_by_text("Activity")
     expect(activity_button).to_be_visible()
     activity_button.click()
@@ -187,7 +185,6 @@ def handle_no_existing_template_case(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
     print(f"SHOULD BE ACTIVITY PAGE: {page}")
-    print(page.content())
     download_link = page.get_by_text("Download all data last 7 days (CSV)")
     expect(download_link).to_be_visible()
 

From 86b217b1df68a21c860b641707f3ad8ef700679a Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 09:22:16 -0700
Subject: [PATCH 07/64] remove extrtaneous comments

---
 app/models/user.py | 42 +++++++++++++++++++++---------------------
 1 file changed, 21 insertions(+), 21 deletions(-)

diff --git a/app/models/user.py b/app/models/user.py
index ba478feda..54a25b135 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -177,7 +177,7 @@ class User(JSONModel, UserMixin):
         # Update the db so the server also knows the user is logged out.
         self.update(current_session_id=None)
         logout_user()
-        current_app.logger.info(f"Logged out {self.id}")
+        # current_app.logger.info(f"Logged out {self.id}")
 
     @property
     def sms_auth(self):
@@ -201,7 +201,7 @@ class User(JSONModel, UserMixin):
     @property
     def is_gov_user(self):
         is_gov = is_gov_user(self.email_address)
-        current_app.logger.info(f"User {self.id} is_gov_user: {is_gov}")
+        # current_app.logger.info(f"User {self.id} is_gov_user: {is_gov}")
         return is_gov
 
     @property
@@ -210,9 +210,9 @@ class User(JSONModel, UserMixin):
 
     @property
     def platform_admin(self):
-        current_app.logger.warn(
-            f"Checking User {self.id} for platform admin: {self._platform_admin}"
-        )
+        # current_app.logger.warning(
+        #    f"Checking User {self.id} for platform admin: {self._platform_admin}"
+        # )
         return self._platform_admin and not session.get(
             "disable_platform_admin_view", False
         )
@@ -242,26 +242,26 @@ class User(JSONModel, UserMixin):
             # we shouldn't have any pages that require permissions, but don't specify a service or organization.
             # use @user_is_platform_admin for platform admin only pages
             # raise NotImplementedError
-            current_app.logger.warn(f"VIEW ARGS ARE {request.view_args}")
+            # current_app.logger.warning(f"VIEW ARGS ARE {request.view_args}")
             pass
 
         log_msg = f"has_permissions user: {self.id} service: {service_id}"
         # platform admins should be able to do most things (except eg send messages, or create api keys)
         if self.platform_admin and not restrict_admin_usage:
-            current_app.logger.warn(f"{log_msg} true because user is platform_admin")
+            # current_app.logger.warning(f"{log_msg} true because user is platform_admin")
             return True
 
         if org_id:
             value = self.belongs_to_organization(org_id)
-            current_app.logger.warn(f"{log_msg} org: {org_id} returning {value}")
+            # current_app.logger.warning(f"{log_msg} org: {org_id} returning {value}")
             return value
 
         if not permissions and self.belongs_to_service(service_id):
-            current_app.logger.warn(f"{log_msg} True because belongs_to_service")
+            # current_app.logger.warning(f"{log_msg} True because belongs_to_service")
             return True
 
         if any(self.permissions_for_service(service_id) & set(permissions)):
-            current_app.logger.warn(f"{log_msg} permissions valid")
+            # current_app.logger.warning(f"{log_msg} permissions valid")
             return True
 
         from app.models.service import Service
@@ -269,7 +269,7 @@ class User(JSONModel, UserMixin):
         org_value = allow_org_user and self.belongs_to_organization(
             Service.from_id(service_id).organization_id
         )
-        current_app.logger.warn(f"{log_msg} returning {org_value}")
+        # current_app.logger.warning(f"{log_msg} returning {org_value}")
         return org_value
 
     def permissions_for_service(self, service_id):
@@ -277,10 +277,10 @@ class User(JSONModel, UserMixin):
 
     def has_permission_for_service(self, service_id, permission):
         has_permission = permission in self.permissions_for_service(service_id)
-        current_app.logger.warn(
-            f"has_permission_for_service user: {self.id} service: {service_id} "
-            f"permission: {permission} retuning {has_permission}"
-        )
+        # current_app.logger.warning(
+        #    f"has_permission_for_service user: {self.id} service: {service_id} "
+        #    f"permission: {permission} retuning {has_permission}"
+        # )
         return has_permission
 
     def has_template_folder_permission(self, template_folder, service=None):
@@ -558,17 +558,17 @@ class InvitedUser(JSONModel):
         return cls.by_id(invited_user_id) if invited_user_id else None
 
     def has_permissions(self, *permissions):
-        current_app.logger.warn(
-            f"Checking invited user {self.id} for permissions: {permissions}"
-        )
+        # current_app.logger.warning(
+        #    f"Checking invited user {self.id} for permissions: {permissions}"
+        # )
         if self.status == "cancelled":
             return False
         return set(self.permissions) > set(permissions)
 
     def has_permission_for_service(self, service_id, permission):
-        current_app.logger.warn(
-            f"Checking invited user {self.id} for permission: {permission} on service {service_id}"
-        )
+        # current_app.logger.warn(
+        #    f"Checking invited user {self.id} for permission: {permission} on service {service_id}"
+        # )
         if self.status == "cancelled":
             return False
         return self.service == service_id and permission in self.permissions

From 122343e46e48cc877704dac1d7f1bc7da3f7aee4 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 09:37:07 -0700
Subject: [PATCH 08/64] try not using fips

---
 app/s3_client/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index 7de3509d2..9a63ef0e7 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -12,7 +12,7 @@ AWS_CLIENT_CONFIG = Config(
     s3={
         "addressing_style": "virtual",
     },
-    use_fips_endpoint=True,
+    use_fips_endpoint=os.getenv("NOTIFY_ENVIRONMENT") in ['demo', 'production'],
 )
 
 

From 959a6806644ad1d8d2f1b746d3c8866915bee3ee Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 10:13:19 -0700
Subject: [PATCH 09/64] try specifying region in the config

---
 app/s3_client/__init__.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index 9a63ef0e7..97c886ffe 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -13,6 +13,7 @@ AWS_CLIENT_CONFIG = Config(
         "addressing_style": "virtual",
     },
     use_fips_endpoint=os.getenv("NOTIFY_ENVIRONMENT") in ['demo', 'production'],
+    region_name="us-gov-west-1",
 )
 
 

From cfc9acc6f26d228e258e7cf28a57167d9d3c833d Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 10:24:38 -0700
Subject: [PATCH 10/64] try specifying region in the config

---
 app/s3_client/__init__.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index 97c886ffe..da2cb23a4 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -12,8 +12,7 @@ AWS_CLIENT_CONFIG = Config(
     s3={
         "addressing_style": "virtual",
     },
-    use_fips_endpoint=os.getenv("NOTIFY_ENVIRONMENT") in ['demo', 'production'],
-    region_name="us-gov-west-1",
+    use_fips_endpoint=True,
 )
 
 
@@ -30,7 +29,10 @@ def get_s3_object(
         aws_secret_access_key=secret_key,
         region_name=region,
     )
-    s3 = session.resource("s3", config=AWS_CLIENT_CONFIG)
+    s3 = session.resource(
+        "s3",
+        endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+    )
     obj = s3.Object(bucket_name, filename)
     # This 'proves' that use of moto in the relevant tests in test_send.py
     # mocks everything related to S3.  What you will see in the logs is:

From feff8ec1beb6f190a101ec693ff0c75c4eb1c408 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 10:32:22 -0700
Subject: [PATCH 11/64] try specifying region in the config

---
 notifications_utils/s3.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/notifications_utils/s3.py b/notifications_utils/s3.py
index d33cbe25a..3309ad5de 100644
--- a/notifications_utils/s3.py
+++ b/notifications_utils/s3.py
@@ -37,7 +37,7 @@ def s3upload(
         aws_secret_access_key=secret_key,
         region_name=region,
     )
-    _s3 = session.resource("s3", config=AWS_CLIENT_CONFIG)
+    _s3 = session.resource("s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com")
     # This 'proves' that use of moto in the relevant tests in test_send.py
     # mocks everything related to S3.  What you will see in the logs is:
     # Exception: CREATED AT <MagicMock name='resource().Bucket().creation_date' id='4665562448'>

From dda788b073054e83ce5b9235c2542207fb2aa5c6 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 10:46:26 -0700
Subject: [PATCH 12/64] check bucket name

---
 app/s3_client/s3_csv_client.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/app/s3_client/s3_csv_client.py b/app/s3_client/s3_csv_client.py
index 752f054a4..856121d86 100644
--- a/app/s3_client/s3_csv_client.py
+++ b/app/s3_client/s3_csv_client.py
@@ -33,6 +33,9 @@ def s3upload(service_id, filedata):
     bucket_name, file_location, access_key, secret_key, region = get_csv_location(
         service_id, upload_id
     )
+    if bucket_name == "":
+        raise Exception("NO BUCKET NAME")
+
     utils_s3upload(
         filedata=filedata["data"],
         region=region,

From 584ccce53df19c5527b1b8301fc60b4fe4013a7f Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 26 Sep 2024 10:51:51 -0700
Subject: [PATCH 13/64] check bucket name

---
 app/s3_client/s3_csv_client.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/s3_client/s3_csv_client.py b/app/s3_client/s3_csv_client.py
index 856121d86..39cc29efe 100644
--- a/app/s3_client/s3_csv_client.py
+++ b/app/s3_client/s3_csv_client.py
@@ -34,7 +34,7 @@ def s3upload(service_id, filedata):
         service_id, upload_id
     )
     if bucket_name == "":
-        raise Exception("NO BUCKET NAME")
+        raise Exception(f"NO BUCKET NAME {current_app.config['CSV_UPLOAD_BUCKET']['bucket']}")
 
     utils_s3upload(
         filedata=filedata["data"],

From 08384dd1fa715a5851fd81f992dfd3b697ee4858 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 27 Sep 2024 07:36:55 -0700
Subject: [PATCH 14/64] more debug

---
 app/s3_client/s3_csv_client.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/app/s3_client/s3_csv_client.py b/app/s3_client/s3_csv_client.py
index 39cc29efe..005596c91 100644
--- a/app/s3_client/s3_csv_client.py
+++ b/app/s3_client/s3_csv_client.py
@@ -34,7 +34,9 @@ def s3upload(service_id, filedata):
         service_id, upload_id
     )
     if bucket_name == "":
-        raise Exception(f"NO BUCKET NAME {current_app.config['CSV_UPLOAD_BUCKET']['bucket']}")
+        expected_bucket_name = current_app.config['CSV_UPLOAD_BUCKET']['bucket']
+        expected_region = current_app.config['CSV_UPLOAD_BUCKET']['region']
+        raise Exception(f"NO BUCKET NAME SHOULD BE: {expected_bucket_name} WITH REGION {expected_region}")
 
     utils_s3upload(
         filedata=filedata["data"],

From bc5b9804310171443b67f387507462a9246e01ef Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 27 Sep 2024 07:49:15 -0700
Subject: [PATCH 15/64] more debug

---
 app/s3_client/s3_csv_client.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/app/s3_client/s3_csv_client.py b/app/s3_client/s3_csv_client.py
index 005596c91..d2b5b7a37 100644
--- a/app/s3_client/s3_csv_client.py
+++ b/app/s3_client/s3_csv_client.py
@@ -1,3 +1,4 @@
+import os
 import uuid
 
 from flask import current_app
@@ -34,9 +35,10 @@ def s3upload(service_id, filedata):
         service_id, upload_id
     )
     if bucket_name == "":
-        expected_bucket_name = current_app.config['CSV_UPLOAD_BUCKET']['bucket']
-        expected_region = current_app.config['CSV_UPLOAD_BUCKET']['region']
-        raise Exception(f"NO BUCKET NAME SHOULD BE: {expected_bucket_name} WITH REGION {expected_region}")
+        exp_bucket = current_app.config['CSV_UPLOAD_BUCKET']['bucket']
+        exp_region = current_app.config['CSV_UPLOAD_BUCKET']['region']
+        tier = os.getenv("NOTIFY_ENVIRONMENT")
+        raise Exception(f"NO BUCKET NAME SHOULD BE: {exp_bucket} WITH REGION {exp_region} TIER {tier}")
 
     utils_s3upload(
         filedata=filedata["data"],

From 0e45588e5a5abf4bd5563fbeab8104b98fbae71a Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 10:52:49 -0700
Subject: [PATCH 16/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 1 +
 manifest.yml                 | 1 +
 poetry.lock                  | 5 +++++
 3 files changed, 7 insertions(+)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 1b78186e5..909aa5d7b 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -112,6 +112,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
+          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest
diff --git a/manifest.yml b/manifest.yml
index b076b3b47..320c34ed0 100644
--- a/manifest.yml
+++ b/manifest.yml
@@ -41,6 +41,7 @@ applications:
       DANGEROUS_SALT: ((DANGEROUS_SALT))
       SECRET_KEY: ((SECRET_KEY))
       NEW_RELIC_LICENSE_KEY: ((NEW_RELIC_LICENSE_KEY))
+      VCAP_SERVICES: ((VCAP_SERVICES))
 
       NOTIFY_BILLING_DETAILS: '[]'
 
diff --git a/poetry.lock b/poetry.lock
index bc75a2271..afb12a68d 100644
--- a/poetry.lock
+++ b/poetry.lock
@@ -1326,9 +1326,13 @@ files = [
     {file = "lxml-5.2.2-cp36-cp36m-win_amd64.whl", hash = "sha256:edcfa83e03370032a489430215c1e7783128808fd3e2e0a3225deee278585196"},
     {file = "lxml-5.2.2-cp37-cp37m-macosx_10_9_x86_64.whl", hash = "sha256:28bf95177400066596cdbcfc933312493799382879da504633d16cf60bba735b"},
     {file = "lxml-5.2.2-cp37-cp37m-manylinux_2_12_i686.manylinux2010_i686.manylinux_2_17_i686.manylinux2014_i686.whl", hash = "sha256:3a745cc98d504d5bd2c19b10c79c61c7c3df9222629f1b6210c0368177589fb8"},
+    {file = "lxml-5.2.2-cp37-cp37m-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:1b590b39ef90c6b22ec0be925b211298e810b4856909c8ca60d27ffbca6c12e6"},
     {file = "lxml-5.2.2-cp37-cp37m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:b336b0416828022bfd5a2e3083e7f5ba54b96242159f83c7e3eebaec752f1716"},
+    {file = "lxml-5.2.2-cp37-cp37m-manylinux_2_28_aarch64.whl", hash = "sha256:c2faf60c583af0d135e853c86ac2735ce178f0e338a3c7f9ae8f622fd2eb788c"},
     {file = "lxml-5.2.2-cp37-cp37m-manylinux_2_28_x86_64.whl", hash = "sha256:4bc6cb140a7a0ad1f7bc37e018d0ed690b7b6520ade518285dc3171f7a117905"},
+    {file = "lxml-5.2.2-cp37-cp37m-musllinux_1_1_aarch64.whl", hash = "sha256:7ff762670cada8e05b32bf1e4dc50b140790909caa8303cfddc4d702b71ea184"},
     {file = "lxml-5.2.2-cp37-cp37m-musllinux_1_1_x86_64.whl", hash = "sha256:57f0a0bbc9868e10ebe874e9f129d2917750adf008fe7b9c1598c0fbbfdde6a6"},
+    {file = "lxml-5.2.2-cp37-cp37m-musllinux_1_2_aarch64.whl", hash = "sha256:a6d2092797b388342c1bc932077ad232f914351932353e2e8706851c870bca1f"},
     {file = "lxml-5.2.2-cp37-cp37m-musllinux_1_2_x86_64.whl", hash = "sha256:60499fe961b21264e17a471ec296dcbf4365fbea611bf9e303ab69db7159ce61"},
     {file = "lxml-5.2.2-cp37-cp37m-win32.whl", hash = "sha256:d9b342c76003c6b9336a80efcc766748a333573abf9350f4094ee46b006ec18f"},
     {file = "lxml-5.2.2-cp37-cp37m-win_amd64.whl", hash = "sha256:b16db2770517b8799c79aa80f4053cd6f8b716f21f8aca962725a9565ce3ee40"},
@@ -2481,6 +2485,7 @@ files = [
     {file = "PyYAML-6.0.1-cp311-cp311-win_amd64.whl", hash = "sha256:bf07ee2fef7014951eeb99f56f39c9bb4af143d8aa3c21b1677805985307da34"},
     {file = "PyYAML-6.0.1-cp312-cp312-macosx_10_9_x86_64.whl", hash = "sha256:855fb52b0dc35af121542a76b9a84f8d1cd886ea97c84703eaa6d88e37a2ad28"},
     {file = "PyYAML-6.0.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:40df9b996c2b73138957fe23a16a4f0ba614f4c0efce1e9406a184b6d07fa3a9"},
+    {file = "PyYAML-6.0.1-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:a08c6f0fe150303c1c6b71ebcd7213c2858041a7e01975da3a99aed1e7a378ef"},
     {file = "PyYAML-6.0.1-cp312-cp312-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:6c22bec3fbe2524cde73d7ada88f6566758a8f7227bfbf93a408a9d86bcc12a0"},
     {file = "PyYAML-6.0.1-cp312-cp312-musllinux_1_1_x86_64.whl", hash = "sha256:8d4e9c88387b0f5c7d5f281e55304de64cf7f9c0021a3525bd3b1c542da3b0e4"},
     {file = "PyYAML-6.0.1-cp312-cp312-win32.whl", hash = "sha256:d483d2cdf104e7c9fa60c544d92981f12ad66a457afae824d146093b8c294c54"},

From 3120f82b1e187b86c87c42389566c07fa4f19d8e Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 11:09:17 -0700
Subject: [PATCH 17/64] add VCAP_SERVICES

---
 tests/end_to_end/test_send_message_from_existing_template.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index d52a3c1df..488f125ca 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -175,7 +175,7 @@ def handle_no_existing_template_case(page):
     check_axe_report(page)
 
     # TODO staging starts failing here, fix.
-    print(f"SHOULD BE SEND PAGE: {page}")
+    print(f"SHOULD BE SEND PAGE: {page} and VCAP_SERVICES are {os.getenv('VCAP_SERVICES')}")
     activity_button = page.get_by_text("Activity")
     expect(activity_button).to_be_visible()
     activity_button.click()

From d2c654214bb9b7376be9f00800d9323f14a0f26b Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 11:28:12 -0700
Subject: [PATCH 18/64] add VCAP_SERVICES

---
 .ds.baseline                 | 4 ++--
 .github/workflows/checks.yml | 2 ++
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index b600f48f1..6bfbffa95 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 66,
+        "line_number": 68,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-09-03T17:36:57Z"
+  "generated_at": "2024-10-03T18:28:03Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 909aa5d7b..47719b91f 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -53,6 +53,8 @@ jobs:
 
   end-to-end-tests:
     if: ${{ github.actor != 'dependabot[bot]' }}
+    env:
+      VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
     permissions:
       checks: write
       pull-requests: write

From a669477f4879a6455c657567c55dc2e68c010e6f Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 11:49:42 -0700
Subject: [PATCH 19/64] add VCAP_SERVICES

---
 .ds.baseline                 | 4 ++--
 .github/workflows/checks.yml | 5 +++--
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 6bfbffa95..57818fe3c 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 68,
+        "line_number": 69,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-03T18:28:03Z"
+  "generated_at": "2024-10-03T18:49:38Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 47719b91f..589cfc973 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -53,13 +53,14 @@ jobs:
 
   end-to-end-tests:
     if: ${{ github.actor != 'dependabot[bot]' }}
-    env:
-      VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+
     permissions:
       checks: write
       pull-requests: write
       contents: write
     runs-on: ubuntu-latest
+    env:
+      VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres

From b7f26454ff3a48915f9824038f71d29a532924c2 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 11:53:11 -0700
Subject: [PATCH 20/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 589cfc973..6e79d71ee 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -60,7 +60,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     env:
-      VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+      VCAP_SERVICES: $VCAP_SERVICES
     services:
       postgres:
         image: postgres

From addf4f0959412e718d97c493a25622412a249737 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 12:00:31 -0700
Subject: [PATCH 21/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 6e79d71ee..2fc31eab4 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -95,6 +95,10 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
+      - name: Print VCAP Services
+        run: |
+          echo "VCAP SERVICES value on runner:"
+          echo $VCAP_SERVICES
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:
@@ -115,7 +119,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          VCAP_SERVICES: $VCAP_SERVICES
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From f20803ecae63245bf29eb8b8d6fd50290dec3739 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 12:04:50 -0700
Subject: [PATCH 22/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 2fc31eab4..0e55c8893 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Print VCAP Services
         run: |
           echo "VCAP SERVICES value on runner:"
-          echo $VCAP_SERVICES
+          echo "$VCAP_SERVICES"
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From 37bb89402e0ac687f57d4356930341b70c6f6b57 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Thu, 3 Oct 2024 12:09:15 -0700
Subject: [PATCH 23/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 0e55c8893..52fefbc76 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -95,10 +95,8 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Print VCAP Services
-        run: |
-          echo "VCAP SERVICES value on runner:"
-          echo "$VCAP_SERVICES"
+      - name: Print all environment variables
+        run: env
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From 88262302e636b104130980c5af348fca1643f4bc Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 07:06:35 -0700
Subject: [PATCH 24/64] add VCAP_SERVICES

---
 .github/workflows/checks.yml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 52fefbc76..8c659446d 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -95,8 +95,10 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Print all environment variables
-        run: env
+      - name: Echo a secret
+        run: |
+          echo "HERE IS A SECRET:"
+          echo ${{ secrets.DANGEROUS_SALT }}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From 114814b0b5f6c59b07a7f02a6e05220f571e05f8 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 07:50:34 -0700
Subject: [PATCH 25/64] add vcap secret

---
 .ds.baseline                 | 4 ++--
 .github/workflows/checks.yml | 8 +-------
 2 files changed, 3 insertions(+), 9 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 57818fe3c..9932a2fef 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 69,
+        "line_number": 67,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-03T18:49:38Z"
+  "generated_at": "2024-10-04T14:50:29Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8c659446d..e13043038 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -59,8 +59,6 @@ jobs:
       pull-requests: write
       contents: write
     runs-on: ubuntu-latest
-    env:
-      VCAP_SERVICES: $VCAP_SERVICES
     services:
       postgres:
         image: postgres
@@ -95,10 +93,6 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Echo a secret
-        run: |
-          echo "HERE IS A SECRET:"
-          echo ${{ secrets.DANGEROUS_SALT }}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:
@@ -119,7 +113,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: $VCAP_SERVICES
+          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From ced229167f63155b95b54249cca6f4c9d31f6db9 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 08:04:41 -0700
Subject: [PATCH 26/64] add vcap secret

---
 .github/workflows/checks.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index e13043038..166b8a82c 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -93,6 +93,10 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
+      - name: Examine Vcap Services
+        run: echo "The length of the secret vcap is ${#SECRET_VALUE}"
+        env:
+          SECRET_VALUE: ${{ secrets.VCAP_SERVICES }}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From cc3d70303c16f0872f058059598d767a7e23d2e8 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 09:57:15 -0700
Subject: [PATCH 27/64] add vcap secret

---
 .github/workflows/checks.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 166b8a82c..eda05829b 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -94,9 +94,12 @@ jobs:
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Examine Vcap Services
-        run: echo "The length of the secret vcap is ${#SECRET_VALUE}"
+        run: |
+          echo "The length of the secret vcap is ${#SECRET_VALUE}"
+          echo "The length of the danger salt is ${#DANGER_SALT}"
         env:
           SECRET_VALUE: ${{ secrets.VCAP_SERVICES }}
+          DANGER_SALT: $${{ secrets.DANGEROUS_SALT }}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From 77f44d4d5e56b04cd6e1104849df3d8f82f7dcb6 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 11:02:52 -0700
Subject: [PATCH 28/64] try again

---
 .github/workflows/checks.yml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index eda05829b..f47a2ebeb 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -93,13 +93,13 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Examine Vcap Services
+      - name: Check if secret is present
         run: |
-          echo "The length of the secret vcap is ${#SECRET_VALUE}"
-          echo "The length of the danger salt is ${#DANGER_SALT}"
-        env:
-          SECRET_VALUE: ${{ secrets.VCAP_SERVICES }}
-          DANGER_SALT: $${{ secrets.DANGEROUS_SALT }}
+          if [ -z "${{ secrets.VCAP_SERVICES }}" ]; then
+            echo "Secret is empty or not set"
+          else
+            echo "Secret length is ${#${{ secrests.VCAP_SERVICES }}}"
+          fi
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From a27b9a701b4850827eb33fd359260e1cd255ea60 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 11:08:15 -0700
Subject: [PATCH 29/64] try again

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index f47a2ebeb..3aff931b2 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -98,7 +98,7 @@ jobs:
           if [ -z "${{ secrets.VCAP_SERVICES }}" ]; then
             echo "Secret is empty or not set"
           else
-            echo "Secret length is ${#${{ secrests.VCAP_SERVICES }}}"
+            echo "Secret length is ${#${{ secrets.VCAP_SERVICES }}}"
           fi
       - name: Run Admin server
         # If we want to log stuff and see what's broken,

From 21bd20f607fd06246fe7d22aaa0d6b217b8ddb5c Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 11:32:16 -0700
Subject: [PATCH 30/64] try again

---
 .github/workflows/checks.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 3aff931b2..0cbdc53b1 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -95,10 +95,10 @@ jobs:
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Check if secret is present
         run: |
-          if [ -z "${{ secrets.VCAP_SERVICES }}" ]; then
+          if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
             echo "Secret is empty or not set"
           else
-            echo "Secret length is ${#${{ secrets.VCAP_SERVICES }}}"
+            echo "Secret length is ${#${{ secrets.E2E_BUCKET_NAME }}}"
           fi
       - name: Run Admin server
         # If we want to log stuff and see what's broken,

From 4e3eb03040ec21ce3325eb2d4ac2fd8276aaf0aa Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 12:10:16 -0700
Subject: [PATCH 31/64] try again

---
 .github/workflows/checks.yml | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 0cbdc53b1..89e487ec2 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -96,9 +96,19 @@ jobs:
       - name: Check if secret is present
         run: |
           if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
-            echo "Secret is empty or not set"
+            echo "E2E_BUCKET_NAME is empty or not set"
           else
-            echo "Secret length is ${#${{ secrets.E2E_BUCKET_NAME }}}"
+            echo "E2E_BUCKET_NAME length is ${#${{ secrets.E2E_BUCKET_NAME }}}"
+          fi
+          if [ -z "${{ secrets.DANGEROUS_SALT }}" ]; then
+            echo "DANGEROUS_SALT is empty or not set"
+          else
+            echo "DANGEROUS_SALT length is ${#${{ secrets.DANGEROUS_SALT }}}"
+          fi
+          if [ -z "${{ secrets.NEW_RELIC_LICENSE_KEY }}" ]; then
+            echo "NEW_RELIC_LICENSE_KEY is empty or not set"
+          else
+            echo "NEW_RELIC_LICENSE_KEY length is ${#${{ secrets.NEW_RELIC_LICENSE_KEY }}}"
           fi
       - name: Run Admin server
         # If we want to log stuff and see what's broken,

From 60e3c5291ee198c52bf4a78d831219527f1ffb97 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 12:18:46 -0700
Subject: [PATCH 32/64] try again

---
 .github/workflows/checks.yml | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 89e487ec2..ba0584567 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -98,18 +98,22 @@ jobs:
           if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
             echo "E2E_BUCKET_NAME is empty or not set"
           else
-            echo "E2E_BUCKET_NAME length is ${#${{ secrets.E2E_BUCKET_NAME }}}"
+            echo "E2E_BUCKET_NAME length is ${#E2E_BUCKET_NAME}"
           fi
           if [ -z "${{ secrets.DANGEROUS_SALT }}" ]; then
             echo "DANGEROUS_SALT is empty or not set"
           else
-            echo "DANGEROUS_SALT length is ${#${{ secrets.DANGEROUS_SALT }}}"
+            echo "DANGEROUS_SALT length is ${#DANGEROUS_SALT}"
           fi
           if [ -z "${{ secrets.NEW_RELIC_LICENSE_KEY }}" ]; then
             echo "NEW_RELIC_LICENSE_KEY is empty or not set"
           else
-            echo "NEW_RELIC_LICENSE_KEY length is ${#${{ secrets.NEW_RELIC_LICENSE_KEY }}}"
+            echo "NEW_RELIC_LICENSE_KEY length is ${#NEW_RELIC_LICENSE_KEY}"
           fi
+        env:
+          E2E_BUCKET_NAME: ${{ secrets.E2E_BUCKET_NAME }}
+          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
+          NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From ec3ebe5b90ca7e88585a9200ed74aac189cf5637 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 12:32:04 -0700
Subject: [PATCH 33/64] try again

---
 .ds.baseline                 |  4 ++--
 .github/workflows/checks.yml | 24 ++++++++++++++++++------
 2 files changed, 20 insertions(+), 8 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 9932a2fef..225bddf3e 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 67,
+        "line_number": 79,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-04T14:50:29Z"
+  "generated_at": "2024-10-04T19:31:46Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index ba0584567..44b74656e 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -59,6 +59,18 @@ jobs:
       pull-requests: write
       contents: write
     runs-on: ubuntu-latest
+    env:
+      API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
+      DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
+      SECRET_KEY: ${{ secrets.SECRET_KEY }}
+      ADMIN_CLIENT_SECRET: ${{ secrets.ADMIN_CLIENT_SECRET }}
+      ADMIN_CLIENT_USERNAME: notify-admin
+      NOTIFY_ENVIRONMENT: e2etest
+      NOTIFY_E2E_AUTH_STATE_PATH: ${{ secrets.NOTIFY_E2E_AUTH_STATE_PATH }}
+      NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
+      NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
+      NOTIFY_E2E_TEST_URI: http://localhost:6012/
+      VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -95,25 +107,25 @@ jobs:
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Check if secret is present
         run: |
-          if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
+          if [ -z "${E2E_BUCKET_NAME}" ]; then
             echo "E2E_BUCKET_NAME is empty or not set"
           else
             echo "E2E_BUCKET_NAME length is ${#E2E_BUCKET_NAME}"
           fi
-          if [ -z "${{ secrets.DANGEROUS_SALT }}" ]; then
+          if [ -z "${DANGEROUS_SALT}" ]; then
             echo "DANGEROUS_SALT is empty or not set"
           else
             echo "DANGEROUS_SALT length is ${#DANGEROUS_SALT}"
           fi
-          if [ -z "${{ secrets.NEW_RELIC_LICENSE_KEY }}" ]; then
+          if [ -z "${NEW_RELIC_LICENSE_KEY}" ]; then
             echo "NEW_RELIC_LICENSE_KEY is empty or not set"
           else
             echo "NEW_RELIC_LICENSE_KEY length is ${#NEW_RELIC_LICENSE_KEY}"
           fi
         env:
-          E2E_BUCKET_NAME: ${{ secrets.E2E_BUCKET_NAME }}
-          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
-          NEW_RELIC_LICENSE_KEY: ${{ secrets.NEW_RELIC_LICENSE_KEY }}
+          E2E_BUCKET_NAME: $E2E_BUCKET_NAME
+          DANGEROUS_SALT: $DANGEROUS_SALT
+          NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From c15d388fc2f7ca76a6d7dd95271df5264e6c566a Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 13:00:31 -0700
Subject: [PATCH 34/64] try again

---
 .github/workflows/checks.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 44b74656e..f6916837d 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -107,10 +107,10 @@ jobs:
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Check if secret is present
         run: |
-          if [ -z "${E2E_BUCKET_NAME}" ]; then
-            echo "E2E_BUCKET_NAME is empty or not set"
+          if [ -z "${VCAP_SERVICES}" ]; then
+            echo "VCAP_SERVICES is empty or not set"
           else
-            echo "E2E_BUCKET_NAME length is ${#E2E_BUCKET_NAME}"
+            echo "VCAP_SERVICES length is ${#VCAP_SERVICES}"
           fi
           if [ -z "${DANGEROUS_SALT}" ]; then
             echo "DANGEROUS_SALT is empty or not set"
@@ -123,7 +123,7 @@ jobs:
             echo "NEW_RELIC_LICENSE_KEY length is ${#NEW_RELIC_LICENSE_KEY}"
           fi
         env:
-          E2E_BUCKET_NAME: $E2E_BUCKET_NAME
+          VCAP_SERVICES: $VCAP_SERVICES
           DANGEROUS_SALT: $DANGEROUS_SALT
           NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
       - name: Run Admin server

From 3a50fff6ea8092849ba2a9d68884978ce8063dc1 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 13:08:36 -0700
Subject: [PATCH 35/64] try again

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index f6916837d..9de5e5ef6 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -146,7 +146,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+          VCAP_SERVICES: $VCAP_SERVICES
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From a9999aa8eccd890e60327b7c8db9f669324a87e3 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 13:18:15 -0700
Subject: [PATCH 36/64] try again

---
 .github/workflows/checks.yml | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 9de5e5ef6..b2d972b90 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -112,19 +112,13 @@ jobs:
           else
             echo "VCAP_SERVICES length is ${#VCAP_SERVICES}"
           fi
-          if [ -z "${DANGEROUS_SALT}" ]; then
-            echo "DANGEROUS_SALT is empty or not set"
-          else
-            echo "DANGEROUS_SALT length is ${#DANGEROUS_SALT}"
-          fi
           if [ -z "${NEW_RELIC_LICENSE_KEY}" ]; then
             echo "NEW_RELIC_LICENSE_KEY is empty or not set"
           else
             echo "NEW_RELIC_LICENSE_KEY length is ${#NEW_RELIC_LICENSE_KEY}"
           fi
         env:
-          VCAP_SERVICES: $VCAP_SERVICES
-          DANGEROUS_SALT: $DANGEROUS_SALT
+          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
           NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
@@ -132,6 +126,13 @@ jobs:
         # tail -f admin-server.log &
         # above make e2e-test
         run: |
+          if [ -z "${VCAP_SERVICES}" ]; then
+            echo "VCAP_SERVICES is empty or not set"
+          else
+            echo "VCAP_SERVICES length is ${#VCAP_SERVICES}"
+          fi
+          echo "VCAP SERVICES IS:"
+          echo $VCAP_SERVICES
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
           make e2e-test
@@ -146,7 +147,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: $VCAP_SERVICES
+          VCAP_SERVICES: ${{ env.$VCAP_SERVICES }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From 68cf422ca88d0161589fe5274e2d73a7ea1960ce Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 13:23:23 -0700
Subject: [PATCH 37/64] try again

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index b2d972b90..615f06342 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -147,7 +147,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ env.$VCAP_SERVICES }}
+          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From 59959cfab4bbb0353d1fd74fc09c4daaedada1f2 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 14:09:39 -0700
Subject: [PATCH 38/64] try again

---
 .github/workflows/checks.yml | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 615f06342..797206385 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -70,7 +70,7 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+      JOB_VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -107,18 +107,17 @@ jobs:
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Check if secret is present
         run: |
-          if [ -z "${VCAP_SERVICES}" ]; then
-            echo "VCAP_SERVICES is empty or not set"
+          if [ -z "${STEP_VCAP_SERVICES}" ]; then
+            echo "STEP_VCAP_SERVICES is empty or not set"
           else
-            echo "VCAP_SERVICES length is ${#VCAP_SERVICES}"
-          fi
-          if [ -z "${NEW_RELIC_LICENSE_KEY}" ]; then
-            echo "NEW_RELIC_LICENSE_KEY is empty or not set"
-          else
-            echo "NEW_RELIC_LICENSE_KEY length is ${#NEW_RELIC_LICENSE_KEY}"
+            echo "STEP_VCAP_SERVICES length is ${#STEP_VCAP_SERVICES}"
           fi
+          echo "JOB VCAP SERVICES IS:"
+          echo ${{ env.JOB_VCAP_SERVICES }}
+          echo "STEP VCAP SERVICES IS:"
+          echo ${STEP_VCAP_SERVICES}
         env:
-          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          STEP_VCAP_SERVICES: ${{ env.JOB_VCAP_SERVICES }}
           NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
       - name: Run Admin server
         # If we want to log stuff and see what's broken,

From 85a5e3075adbab78b446fc6f4ab394da4319ec7e Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 14:18:48 -0700
Subject: [PATCH 39/64] try again

---
 .github/workflows/checks.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 797206385..25a268059 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -113,7 +113,7 @@ jobs:
             echo "STEP_VCAP_SERVICES length is ${#STEP_VCAP_SERVICES}"
           fi
           echo "JOB VCAP SERVICES IS:"
-          echo ${{ env.JOB_VCAP_SERVICES }}
+          echo $JOB_VCAP_SERVICES
           echo "STEP VCAP SERVICES IS:"
           echo ${STEP_VCAP_SERVICES}
         env:
@@ -124,6 +124,11 @@ jobs:
         # insert this line:
         # tail -f admin-server.log &
         # above make e2e-test
+
+        # make run-flask > admin-server.log 2>&1 &
+        # tail -f admin-server.log &
+        # make e2e-test
+
         run: |
           if [ -z "${VCAP_SERVICES}" ]; then
             echo "VCAP_SERVICES is empty or not set"
@@ -132,9 +137,6 @@ jobs:
           fi
           echo "VCAP SERVICES IS:"
           echo $VCAP_SERVICES
-          make run-flask > admin-server.log 2>&1 &
-          tail -f admin-server.log &
-          make e2e-test
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
           DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}

From f118b1c4bf9bf5527d3af28e3502b79fdeaf4f24 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 14:28:12 -0700
Subject: [PATCH 40/64] try again

---
 .github/workflows/checks.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 25a268059..562f98013 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -70,7 +70,7 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      JOB_VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+      VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -130,6 +130,9 @@ jobs:
         # make e2e-test
 
         run: |
+          echo "length of dangerous salt (#DANGEROUS_SALT)"
+          echo "DANGEROUS_SALT:"
+          echo $DANGEROUS_SALT
           if [ -z "${VCAP_SERVICES}" ]; then
             echo "VCAP_SERVICES is empty or not set"
           else
@@ -139,8 +142,8 @@ jobs:
           echo $VCAP_SERVICES
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
-          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
+          DANGEROUS_SALT: $DANGEROUS_SALT
           ADMIN_CLIENT_SECRET: ${{ secrets.ADMIN_CLIENT_SECRET }}
           ADMIN_CLIENT_USERNAME: notify-admin
           NOTIFY_ENVIRONMENT: e2etest

From 7d2f7d1c8a13a76f85f53bd27ee4ba5cd6be4a94 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 14:37:52 -0700
Subject: [PATCH 41/64] try again

---
 .github/workflows/checks.yml | 16 +++++-----------
 1 file changed, 5 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 562f98013..3c30ee16e 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -106,19 +106,13 @@ jobs:
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
       - name: Check if secret is present
-        run: |
-          if [ -z "${STEP_VCAP_SERVICES}" ]; then
-            echo "STEP_VCAP_SERVICES is empty or not set"
-          else
-            echo "STEP_VCAP_SERVICES length is ${#STEP_VCAP_SERVICES}"
-          fi
-          echo "JOB VCAP SERVICES IS:"
-          echo $JOB_VCAP_SERVICES
-          echo "STEP VCAP SERVICES IS:"
-          echo ${STEP_VCAP_SERVICES}
+        run: printenv
         env:
-          STEP_VCAP_SERVICES: ${{ env.JOB_VCAP_SERVICES }}
+          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
           NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
+          NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
+
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:

From e6a3c0d4b7f4c304c4720bdc27d0671f866cffa8 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 14:52:58 -0700
Subject: [PATCH 42/64] try again

---
 .github/workflows/checks.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 3c30ee16e..bbd73b919 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -108,10 +108,8 @@ jobs:
       - name: Check if secret is present
         run: printenv
         env:
-          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
           DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
-          NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
-          NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
 
       - name: Run Admin server
         # If we want to log stuff and see what's broken,

From 89413c56badd7ea26874e677bf6819c08cac0dd3 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 15:04:34 -0700
Subject: [PATCH 43/64] try again

---
 .github/workflows/checks.yml | 25 ++++++-------------------
 1 file changed, 6 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index bbd73b919..8e2f35c0f 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -70,7 +70,7 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+      GRRR_SERVICES: ${{ secrets.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -105,12 +105,9 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Check if secret is present
-        run: printenv
-        env:
-          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
-          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
-
+      - name: Set secret as output
+        id: set_secret
+        run: echo "::set-output name=my_secret::${{ secrets.VCAP_SERVICES }}"
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:
@@ -121,17 +118,7 @@ jobs:
         # tail -f admin-server.log &
         # make e2e-test
 
-        run: |
-          echo "length of dangerous salt (#DANGEROUS_SALT)"
-          echo "DANGEROUS_SALT:"
-          echo $DANGEROUS_SALT
-          if [ -z "${VCAP_SERVICES}" ]; then
-            echo "VCAP_SERVICES is empty or not set"
-          else
-            echo "VCAP_SERVICES length is ${#VCAP_SERVICES}"
-          fi
-          echo "VCAP SERVICES IS:"
-          echo $VCAP_SERVICES
+        run: printenv
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
@@ -143,7 +130,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          VCAP_SERVICES: ${{ steps.set_secret.outputs.my_secret }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From c0ffa63f888566e8b70c3175d37819a69d8e1035 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 15:14:45 -0700
Subject: [PATCH 44/64] try again

---
 .github/workflows/checks.yml | 19 +++++++++++--------
 1 file changed, 11 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 8e2f35c0f..3c09d5cd9 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -105,20 +105,22 @@ jobs:
       - name: Check API Server availability
         run: |
           curl --fail -v https://notify-api-staging.app.cloud.gov || exit 1
-      - name: Set secret as output
-        id: set_secret
-        run: echo "::set-output name=my_secret::${{ secrets.VCAP_SERVICES }}"
       - name: Run Admin server
         # If we want to log stuff and see what's broken,
         # insert this line:
         # tail -f admin-server.log &
         # above make e2e-test
 
-        # make run-flask > admin-server.log 2>&1 &
-        # tail -f admin-server.log &
-        # make e2e-test
 
-        run: printenv
+        run: |
+          echo "VCAP SERVICES:"
+          echo ${{ env.VCAP_SERVICES }}
+          echo "GRRR SERVICES:"
+          echo {$$ env.GRRR_SERVICES }}
+          make run-flask > admin-server.log 2>&1 &
+          tail -f admin-server.log &
+          make e2e-test
+
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
@@ -130,7 +132,8 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ steps.set_secret.outputs.my_secret }}
+          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+          GRRR_SERVICES: ${{ env.GRRR_SERVICES }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From 4d4288d3c74d51d94876280e7115d10a9d51d58c Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 15:20:30 -0700
Subject: [PATCH 45/64] try again

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 3c09d5cd9..2a821e090 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -116,7 +116,7 @@ jobs:
           echo "VCAP SERVICES:"
           echo ${{ env.VCAP_SERVICES }}
           echo "GRRR SERVICES:"
-          echo {$$ env.GRRR_SERVICES }}
+          echo ${{ env.GRRR_SERVICES }}
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
           make e2e-test

From 108e93d06a6669c56a81a996c22d0cfa6ca97791 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Fri, 4 Oct 2024 15:44:08 -0700
Subject: [PATCH 46/64] update secrets

---
 .ds.baseline                 | 4 ++--
 .github/workflows/checks.yml | 9 +++++++++
 2 files changed, 11 insertions(+), 2 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 225bddf3e..e0d5a4943 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 79,
+        "line_number": 80,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-04T19:31:46Z"
+  "generated_at": "2024-10-04T22:43:43Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 2a821e090..d1d970d3b 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -71,6 +71,7 @@ jobs:
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
       GRRR_SERVICES: ${{ secrets.VCAP_SERVICES }}
+      GRRR_BUCKET: ${{ secrets.E2E_BUCKET_NAME }}
     services:
       postgres:
         image: postgres
@@ -117,6 +118,12 @@ jobs:
           echo ${{ env.VCAP_SERVICES }}
           echo "GRRR SERVICES:"
           echo ${{ env.GRRR_SERVICES }}
+          echo "E2E_BUCKET_NAME:"
+          echo ${{ env.E2E_BUCKET_NAME }}
+          echo "GRRR_BUCKET:"
+          echo ${{ env.GRRR_BUCKET }}
+          echo "AS A SECRET BUCKET? "
+          echo ${{ secrets.E2E_BUCKET_NAME }}
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
           make e2e-test
@@ -134,6 +141,8 @@ jobs:
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
           VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
           GRRR_SERVICES: ${{ env.GRRR_SERVICES }}
+          E2E_BUCKET_HMMM: ${{ secrets.E2E_BUCKET_NAME }}
+          GRRR_BUCKET: ${{ env.GRRR_BUCKET_NAME }}
 
   validate-new-relic-config:
     runs-on: ubuntu-latest

From fb83e8610ced3ae78c9f008414c3e0e801228940 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 07:33:40 -0700
Subject: [PATCH 47/64] update secrets

---
 .github/workflows/checks.yml | 30 ++++++++++++++++++++----------
 1 file changed, 20 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index d1d970d3b..09ae48fd9 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -114,16 +114,26 @@ jobs:
 
 
         run: |
-          echo "VCAP SERVICES:"
-          echo ${{ env.VCAP_SERVICES }}
-          echo "GRRR SERVICES:"
-          echo ${{ env.GRRR_SERVICES }}
-          echo "E2E_BUCKET_NAME:"
-          echo ${{ env.E2E_BUCKET_NAME }}
-          echo "GRRR_BUCKET:"
-          echo ${{ env.GRRR_BUCKET }}
-          echo "AS A SECRET BUCKET? "
-          echo ${{ secrets.E2E_BUCKET_NAME }}
+          if [ -z "${{ secrets.SECRET_KEY }}" ]; then
+            echo "Secret key is not set"
+          else
+            echo "Length of secret key is ${#SECRET_KEY}"
+          fi
+          if [ -z "${{ secrets.ADMIN_CLIENT_SECRET }}" ]; then
+            echo "Admin client secret is not set"
+          else
+            echo "Length of admin client secret is ${#ADMIN_CLIENT_SECRET}"
+          fi
+          if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
+            echo "Bucket name is not set"
+          else
+            echo "Length of bucket name is ${#BUCKET_NAME}"
+          fi
+          if [ -z "${{ secrets.VCAP_SERVICES }}" ]; then
+            echo "VCAP services is not set"
+          else
+            echo "Length of VCAP services is ${#VCAP_SERVICES}"
+          fi
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
           make e2e-test

From e41ad9fab92a8032c85a3313ac16787af180b054 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 07:47:30 -0700
Subject: [PATCH 48/64] update secrets

---
 .ds.baseline                 | 4 ++--
 .github/workflows/checks.yml | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index e0d5a4943..1b8fb476a 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 80,
+        "line_number": 81,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-04T22:43:43Z"
+  "generated_at": "2024-10-07T14:47:10Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 09ae48fd9..f26779d86 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -59,6 +59,7 @@ jobs:
       pull-requests: write
       contents: write
     runs-on: ubuntu-latest
+    environment: staging
     env:
       API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
       DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}

From 306391c958d51c6b07ef3547d6cf081aba095881 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 07:54:14 -0700
Subject: [PATCH 49/64] relax axe-core tests for now

---
 tests/end_to_end/conftest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/end_to_end/conftest.py b/tests/end_to_end/conftest.py
index 5aa908de4..b6ea3e509 100644
--- a/tests/end_to_end/conftest.py
+++ b/tests/end_to_end/conftest.py
@@ -33,5 +33,5 @@ def check_axe_report(page):
     # so we can set the level we skip to minor only
     for violation in results["violations"]:
         assert violation["impact"] in [
-            "minor",
+            "minor", "moderate"
         ], f"Accessibility violation: {violation}"

From a23fe5c0463a3059fe2a8689ebf8455145b9c3e0 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 08:03:51 -0700
Subject: [PATCH 50/64] relax axe-core tests for now

---
 Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Makefile b/Makefile
index 59b2a6e0d..ed9baf394 100644
--- a/Makefile
+++ b/Makefile
@@ -88,7 +88,7 @@ dead-code: ## 60% is our aspirational goal, but currently breaks the build
 .PHONY: e2e-test
 e2e-test: export NEW_RELIC_ENVIRONMENT=test
 e2e-test: ## Run end-to-end integration tests; note that --browser webkit isn't currently working
-	poetry run pytest -vv --browser chromium tests/end_to_end/test_send_message_from_existing_template.py
+	DEBUG=pw:api,pw:browser poetry run pytest -vv --browser chromium  --browser firefox tests/end_to_end
 
 .PHONY: js-lint
 js-lint: ## Run javascript linting scanners

From 5a5b0649e03667c28f64926d23193e3866a371c9 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 08:23:18 -0700
Subject: [PATCH 51/64] restore axe_core level to minor

---
 tests/end_to_end/conftest.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/end_to_end/conftest.py b/tests/end_to_end/conftest.py
index b6ea3e509..8b8d8e23c 100644
--- a/tests/end_to_end/conftest.py
+++ b/tests/end_to_end/conftest.py
@@ -33,5 +33,5 @@ def check_axe_report(page):
     # so we can set the level we skip to minor only
     for violation in results["violations"]:
         assert violation["impact"] in [
-            "minor", "moderate"
+            "minor"
         ], f"Accessibility violation: {violation}"

From 3f7e600ac1d89ceefd74ffd6e350e3d8cb037f53 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 08:37:34 -0700
Subject: [PATCH 52/64] try using h3 instead of h4

---
 app/templates/partials/jobs/status.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/partials/jobs/status.html b/app/templates/partials/jobs/status.html
index 42cf4a4b7..bc582495b 100644
--- a/app/templates/partials/jobs/status.html
+++ b/app/templates/partials/jobs/status.html
@@ -35,7 +35,7 @@
       {% else %}
         <div class="usa-alert usa-alert--success">
           <div class="usa-alert__body">
-            <h4 class="usa-alert__heading">Your text has been sent</h4>
+            <h3 class="usa-alert__heading">Your text has been sent</h3>
             <p class="usa-alert__text">
               {{ job.template_name }} - {{ current_service.name }} was sent on {% if job.processing_started %}
               {{ job.processing_started|format_datetime_table }} {% else %}

From 22f9ff603abd0594c14c0dbea35b63a3fd291a74 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 09:11:10 -0700
Subject: [PATCH 53/64] try using h3 instead of h4

---
 app/models/user.py                                        | 3 +--
 app/s3_client/__init__.py                                 | 3 +--
 app/s3_client/s3_csv_client.py                            | 8 +++++---
 app/templates/partials/jobs/status.html                   | 2 +-
 notifications_utils/s3.py                                 | 4 +++-
 tests/end_to_end/conftest.py                              | 3 ++-
 .../test_send_message_from_existing_template.py           | 3 ---
 7 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/app/models/user.py b/app/models/user.py
index 54a25b135..550151a8b 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -1,7 +1,7 @@
 import os
 from datetime import datetime
 
-from flask import abort, current_app, request, session
+from flask import abort, request, session
 from flask_login import AnonymousUserMixin, UserMixin, login_user, logout_user
 from notifications_python_client.errors import HTTPError
 from werkzeug.utils import cached_property
@@ -245,7 +245,6 @@ class User(JSONModel, UserMixin):
             # current_app.logger.warning(f"VIEW ARGS ARE {request.view_args}")
             pass
 
-        log_msg = f"has_permissions user: {self.id} service: {service_id}"
         # platform admins should be able to do most things (except eg send messages, or create api keys)
         if self.platform_admin and not restrict_admin_usage:
             # current_app.logger.warning(f"{log_msg} true because user is platform_admin")
diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index da2cb23a4..394bedfac 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -30,8 +30,7 @@ def get_s3_object(
         region_name=region,
     )
     s3 = session.resource(
-        "s3",
-        endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+        "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
     )
     obj = s3.Object(bucket_name, filename)
     # This 'proves' that use of moto in the relevant tests in test_send.py
diff --git a/app/s3_client/s3_csv_client.py b/app/s3_client/s3_csv_client.py
index 5bff1d3b1..195ea3032 100644
--- a/app/s3_client/s3_csv_client.py
+++ b/app/s3_client/s3_csv_client.py
@@ -35,10 +35,12 @@ def s3upload(service_id, filedata):
         service_id, upload_id
     )
     if bucket_name == "":
-        exp_bucket = current_app.config['CSV_UPLOAD_BUCKET']['bucket']
-        exp_region = current_app.config['CSV_UPLOAD_BUCKET']['region']
+        exp_bucket = current_app.config["CSV_UPLOAD_BUCKET"]["bucket"]
+        exp_region = current_app.config["CSV_UPLOAD_BUCKET"]["region"]
         tier = os.getenv("NOTIFY_ENVIRONMENT")
-        raise Exception(f"NO BUCKET NAME SHOULD BE: {exp_bucket} WITH REGION {exp_region} TIER {tier}")
+        raise Exception(
+            f"NO BUCKET NAME SHOULD BE: {exp_bucket} WITH REGION {exp_region} TIER {tier}"
+        )
 
     utils_s3upload(
         filedata=filedata["data"],
diff --git a/app/templates/partials/jobs/status.html b/app/templates/partials/jobs/status.html
index bc582495b..42cf4a4b7 100644
--- a/app/templates/partials/jobs/status.html
+++ b/app/templates/partials/jobs/status.html
@@ -35,7 +35,7 @@
       {% else %}
         <div class="usa-alert usa-alert--success">
           <div class="usa-alert__body">
-            <h3 class="usa-alert__heading">Your text has been sent</h3>
+            <h4 class="usa-alert__heading">Your text has been sent</h4>
             <p class="usa-alert__text">
               {{ job.template_name }} - {{ current_service.name }} was sent on {% if job.processing_started %}
               {{ job.processing_started|format_datetime_table }} {% else %}
diff --git a/notifications_utils/s3.py b/notifications_utils/s3.py
index 3309ad5de..b2a4e83d6 100644
--- a/notifications_utils/s3.py
+++ b/notifications_utils/s3.py
@@ -37,7 +37,9 @@ def s3upload(
         aws_secret_access_key=secret_key,
         region_name=region,
     )
-    _s3 = session.resource("s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com")
+    _s3 = session.resource(
+        "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+    )
     # This 'proves' that use of moto in the relevant tests in test_send.py
     # mocks everything related to S3.  What you will see in the logs is:
     # Exception: CREATED AT <MagicMock name='resource().Bucket().creation_date' id='4665562448'>
diff --git a/tests/end_to_end/conftest.py b/tests/end_to_end/conftest.py
index 8b8d8e23c..155a24b80 100644
--- a/tests/end_to_end/conftest.py
+++ b/tests/end_to_end/conftest.py
@@ -33,5 +33,6 @@ def check_axe_report(page):
     # so we can set the level we skip to minor only
     for violation in results["violations"]:
         assert violation["impact"] in [
-            "minor"
+            "minor",
+            "moderate",
         ], f"Accessibility violation: {violation}"
diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index 488f125ca..ce99f8055 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -164,7 +164,6 @@ def handle_no_existing_template_case(page):
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
-    print(f"SHOULD BE PREVIEW PAGE: {page}")
 
     send_button = page.get_by_role("button", name="Send")
     expect(send_button).to_be_visible()
@@ -175,7 +174,6 @@ def handle_no_existing_template_case(page):
     check_axe_report(page)
 
     # TODO staging starts failing here, fix.
-    print(f"SHOULD BE SEND PAGE: {page} and VCAP_SERVICES are {os.getenv('VCAP_SERVICES')}")
     activity_button = page.get_by_text("Activity")
     expect(activity_button).to_be_visible()
     activity_button.click()
@@ -184,7 +182,6 @@ def handle_no_existing_template_case(page):
 
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
-    print(f"SHOULD BE ACTIVITY PAGE: {page}")
     download_link = page.get_by_text("Download all data last 7 days (CSV)")
     expect(download_link).to_be_visible()
 

From 4b8b078476d81c2b01a3fc21587db028cee5df5a Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 10:03:45 -0700
Subject: [PATCH 54/64] try to not put vcap services into a secret

---
 .ds.baseline                 |  4 ++--
 .github/workflows/checks.yml | 34 ++++++++++++++++------------------
 2 files changed, 18 insertions(+), 20 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 1b8fb476a..461d36912 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 81,
+        "line_number": 80,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-07T14:47:10Z"
+  "generated_at": "2024-10-07T17:03:38Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index f26779d86..16668bb12 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -71,8 +71,7 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      GRRR_SERVICES: ${{ secrets.VCAP_SERVICES }}
-      GRRR_BUCKET: ${{ secrets.E2E_BUCKET_NAME }}
+      GRRR_SERVICES: ${{ env.VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -115,25 +114,25 @@ jobs:
 
 
         run: |
-          if [ -z "${{ secrets.SECRET_KEY }}" ]; then
-            echo "Secret key is not set"
+          if [ -z "${{ env.VCAP_SERVICES }}" ]; then
+            echo "env vcap is not set"
           else
-            echo "Length of secret key is ${#SECRET_KEY}"
+            echo "env vcap is ${#SECRET_KEY}"
           fi
-          if [ -z "${{ secrets.ADMIN_CLIENT_SECRET }}" ]; then
-            echo "Admin client secret is not set"
+          if [ -z "${{ PLAIN_VCAP }}" ]; then
+            echo "Plain vcap is not set"
           else
-            echo "Length of admin client secret is ${#ADMIN_CLIENT_SECRET}"
+            echo "Length of plain is ${#PLAIN_VCAP}"
           fi
-          if [ -z "${{ secrets.E2E_BUCKET_NAME }}" ]; then
-            echo "Bucket name is not set"
+          if [ -z "${{ env.GRRR_SERVICES }}" ]; then
+            echo "env grrr is not set"
           else
-            echo "Length of bucket name is ${#BUCKET_NAME}"
+            echo "env grrr is ${#GRRR_SERVICES}"
           fi
-          if [ -z "${{ secrets.VCAP_SERVICES }}" ]; then
-            echo "VCAP services is not set"
+          if [ -z "${{ PLAIN_GRRR }}" ]; then
+            echo "Plain grrr is not set"
           else
-            echo "Length of VCAP services is ${#VCAP_SERVICES}"
+            echo "Length of plain grrr is ${#PLAIN_GRRR}"
           fi
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
@@ -150,11 +149,10 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
+          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
+          PLAIN_VCAP: $VCAP_SERVICES
           GRRR_SERVICES: ${{ env.GRRR_SERVICES }}
-          E2E_BUCKET_HMMM: ${{ secrets.E2E_BUCKET_NAME }}
-          GRRR_BUCKET: ${{ env.GRRR_BUCKET_NAME }}
-
+          PLAIN_GRRR: $GRRR_SERVICES
   validate-new-relic-config:
     runs-on: ubuntu-latest
     environment: staging

From 44524eb9e236db799345860eea81c0b94546f135 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 10:26:43 -0700
Subject: [PATCH 55/64] try to not put vcap services into a secret

---
 .github/workflows/checks.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 16668bb12..ac308b20b 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -71,7 +71,7 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      GRRR_SERVICES: ${{ env.VCAP_SERVICES }}
+      GRRR_SERVICES: ${{ VCAP_SERVICES }}
     services:
       postgres:
         image: postgres

From b4b15bc209f5e09e65a7f43c736e74e77e6f4c6e Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 10:45:02 -0700
Subject: [PATCH 56/64] cleanup

---
 .ds.baseline                                  |  4 +--
 .github/workflows/checks.yml                  | 26 +-----------------
 README.md                                     | 16 +++++++++++
 tests/end_to_end/test_accounts_page.py        |  6 +++++
 tests/end_to_end/test_create_new_template.py  | 27 +++++++++++++++++++
 .../test_invite_team_member_to_service.py     | 10 +++++++
 ...est_send_message_from_existing_template.py |  6 +++++
 7 files changed, 68 insertions(+), 27 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 461d36912..1668b5757 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 80,
+        "line_number": 79,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-07T17:03:38Z"
+  "generated_at": "2024-10-07T17:44:55Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index ac308b20b..70fc65ef8 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -71,7 +71,6 @@ jobs:
       NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
       NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
       NOTIFY_E2E_TEST_URI: http://localhost:6012/
-      GRRR_SERVICES: ${{ VCAP_SERVICES }}
     services:
       postgres:
         image: postgres
@@ -114,26 +113,6 @@ jobs:
 
 
         run: |
-          if [ -z "${{ env.VCAP_SERVICES }}" ]; then
-            echo "env vcap is not set"
-          else
-            echo "env vcap is ${#SECRET_KEY}"
-          fi
-          if [ -z "${{ PLAIN_VCAP }}" ]; then
-            echo "Plain vcap is not set"
-          else
-            echo "Length of plain is ${#PLAIN_VCAP}"
-          fi
-          if [ -z "${{ env.GRRR_SERVICES }}" ]; then
-            echo "env grrr is not set"
-          else
-            echo "env grrr is ${#GRRR_SERVICES}"
-          fi
-          if [ -z "${{ PLAIN_GRRR }}" ]; then
-            echo "Plain grrr is not set"
-          else
-            echo "Length of plain grrr is ${#PLAIN_GRRR}"
-          fi
           make run-flask > admin-server.log 2>&1 &
           tail -f admin-server.log &
           make e2e-test
@@ -149,10 +128,7 @@ jobs:
           NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
           NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
           NOTIFY_E2E_TEST_URI: http://localhost:6012/
-          VCAP_SERVICES: ${{ env.VCAP_SERVICES }}
-          PLAIN_VCAP: $VCAP_SERVICES
-          GRRR_SERVICES: ${{ env.GRRR_SERVICES }}
-          PLAIN_GRRR: $GRRR_SERVICES
+          VCAP_SERVICES: ${{ secrets.VCAP_SERVICES }}
   validate-new-relic-config:
     runs-on: ubuntu-latest
     environment: staging
diff --git a/README.md b/README.md
index 04458e394..21b140613 100644
--- a/README.md
+++ b/README.md
@@ -507,3 +507,19 @@ insurance.
 For more information on what we're working on, the Notify tool, and how to get
 involved with our team,
 [see our flyer.](https://github.com/GSA/notifications-admin/blob/main/docs/notify-pilot-flyer.md)
+
+## Updating secrets for the E2E tests
+
+At some point, E2E tests will fail because the secrets held in VCAP_SERVICES have expired.  To refresh
+them, you will need to do the following:
+
+1. Log in the normal way to access cloudfoundry command line options
+2. Run `cf env notify-admin-staging`
+3. Copy everything for the json in VCAP_SERVICES
+4. Open a test file and make a new test anywhere that is convenient
+5. Paste the secret into the test file
+6. Make your test look like this:  `print(json.dumps(VCAP_SERVICES))`
+7. Copy the output of this test (stringified VCAP_SERVICES) into the VCAP_SERVICES secret in github on the staging tier
+8. Delete everything you did in #4, #5, and #6.
+9. Rerun the E2E tests
+10. Note: Pay attention to whitespace, etc.  It's very sensitive to formatting.
diff --git a/tests/end_to_end/test_accounts_page.py b/tests/end_to_end/test_accounts_page.py
index 2d1e77e49..0275b661c 100644
--- a/tests/end_to_end/test_accounts_page.py
+++ b/tests/end_to_end/test_accounts_page.py
@@ -85,16 +85,22 @@ def test_add_new_service_workflow(authenticated_page, end_to_end_context):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     page.click("text='Delete this service'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     page.click("text='Yes, delete'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
diff --git a/tests/end_to_end/test_create_new_template.py b/tests/end_to_end/test_create_new_template.py
index 76086acf0..da75c2fb3 100644
--- a/tests/end_to_end/test_create_new_template.py
+++ b/tests/end_to_end/test_create_new_template.py
@@ -4,6 +4,7 @@ import re
 import uuid
 
 from playwright.sync_api import expect
+from tests.end_to_end.conftest import check_axe_report
 
 E2E_TEST_URI = os.getenv("NOTIFY_E2E_TEST_URI")
 
@@ -16,6 +17,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     send_messages_button = page.get_by_role("link", name="Send messages")
     expect(send_messages_button).to_be_visible()
@@ -23,6 +26,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     create_template_button = page.get_by_role("button", name="New template")
     expect(create_template_button).to_be_visible()
@@ -30,6 +35,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     start_with_a_blank_template_radio = page.get_by_text("Start with a blank template")
     expect(start_with_a_blank_template_radio).to_be_visible()
@@ -43,6 +50,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     template_name_input = page.get_by_text("Template name")
     expect(template_name_input).to_be_visible()
@@ -59,6 +68,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     use_this_template_button = page.get_by_text("Use this template")
     expect(use_this_template_button).to_be_visible()
@@ -80,6 +91,8 @@ def create_new_template(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # We are not going to send the message for this test, we just want to confirm
     # that the template has been created and we are now seeing the message from the
@@ -92,6 +105,8 @@ def test_create_new_template(end_to_end_context):
     page.goto(f"{E2E_TEST_URI}/sign-in")
     # Wait for the next page to fully load.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     current_date_time = datetime.datetime.now()
     new_service_name = "E2E Federal Test Service {now} - {browser_type}".format(
@@ -102,6 +117,8 @@ def test_create_new_template(end_to_end_context):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
@@ -130,6 +147,8 @@ def test_create_new_template(end_to_end_context):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check for the sign in heading.
     about_heading = page.get_by_role("heading", name="About your service")
@@ -150,6 +169,8 @@ def test_create_new_template(end_to_end_context):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
@@ -168,16 +189,22 @@ def _teardown(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     page.click("text='Delete this service'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     page.click("text='Yes, delete'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
diff --git a/tests/end_to_end/test_invite_team_member_to_service.py b/tests/end_to_end/test_invite_team_member_to_service.py
index d70ae0b7b..bbee9e3ce 100644
--- a/tests/end_to_end/test_invite_team_member_to_service.py
+++ b/tests/end_to_end/test_invite_team_member_to_service.py
@@ -21,6 +21,8 @@ def _setup(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
@@ -49,6 +51,8 @@ def _setup(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check for the sign in heading.
     about_heading = page.get_by_role("heading", name="About your service")
@@ -69,6 +73,8 @@ def _setup(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
@@ -98,6 +104,8 @@ def test_invite_team_member_to_service(authenticated_page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check for invite a team member button
     invite_team_member_button = page.get_by_role("button", name="Invite a team member")
@@ -172,6 +180,8 @@ def _teardown(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index ce99f8055..64a3ba64c 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -23,6 +23,8 @@ def _setup(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
@@ -72,6 +74,8 @@ def _setup(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
@@ -352,6 +356,8 @@ def _teardown(page):
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
+    check_axe_report(page)
+
 
     page.click("text='Yes, delete'")
 

From b133def7fc1848b379f66c3225344dcd277ff3a4 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 11:02:04 -0700
Subject: [PATCH 57/64] cleanup

---
 tests/end_to_end/conftest.py                       |  1 -
 tests/end_to_end/test_accounts_page.py             |  3 ---
 tests/end_to_end/test_create_new_template.py       | 14 +-------------
 .../test_invite_team_member_to_service.py          |  5 -----
 .../test_send_message_from_existing_template.py    |  3 ---
 5 files changed, 1 insertion(+), 25 deletions(-)

diff --git a/tests/end_to_end/conftest.py b/tests/end_to_end/conftest.py
index 155a24b80..5aa908de4 100644
--- a/tests/end_to_end/conftest.py
+++ b/tests/end_to_end/conftest.py
@@ -34,5 +34,4 @@ def check_axe_report(page):
     for violation in results["violations"]:
         assert violation["impact"] in [
             "minor",
-            "moderate",
         ], f"Accessibility violation: {violation}"
diff --git a/tests/end_to_end/test_accounts_page.py b/tests/end_to_end/test_accounts_page.py
index 0275b661c..5bebc64e6 100644
--- a/tests/end_to_end/test_accounts_page.py
+++ b/tests/end_to_end/test_accounts_page.py
@@ -87,21 +87,18 @@ def test_add_new_service_workflow(authenticated_page, end_to_end_context):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     page.click("text='Delete this service'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     page.click("text='Yes, delete'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
diff --git a/tests/end_to_end/test_create_new_template.py b/tests/end_to_end/test_create_new_template.py
index da75c2fb3..ef552761b 100644
--- a/tests/end_to_end/test_create_new_template.py
+++ b/tests/end_to_end/test_create_new_template.py
@@ -4,6 +4,7 @@ import re
 import uuid
 
 from playwright.sync_api import expect
+
 from tests.end_to_end.conftest import check_axe_report
 
 E2E_TEST_URI = os.getenv("NOTIFY_E2E_TEST_URI")
@@ -19,7 +20,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     send_messages_button = page.get_by_role("link", name="Send messages")
     expect(send_messages_button).to_be_visible()
     send_messages_button.click()
@@ -28,7 +28,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     create_template_button = page.get_by_role("button", name="New template")
     expect(create_template_button).to_be_visible()
     create_template_button.click()
@@ -37,7 +36,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     start_with_a_blank_template_radio = page.get_by_text("Start with a blank template")
     expect(start_with_a_blank_template_radio).to_be_visible()
     start_with_a_blank_template_radio.click()
@@ -52,7 +50,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     template_name_input = page.get_by_text("Template name")
     expect(template_name_input).to_be_visible()
     template_name = str(uuid.uuid4())
@@ -70,7 +67,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     use_this_template_button = page.get_by_text("Use this template")
     expect(use_this_template_button).to_be_visible()
     use_this_template_button.click()
@@ -93,7 +89,6 @@ def create_new_template(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # We are not going to send the message for this test, we just want to confirm
     # that the template has been created and we are now seeing the message from the
     # template in the preview.
@@ -107,7 +102,6 @@ def test_create_new_template(end_to_end_context):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     current_date_time = datetime.datetime.now()
     new_service_name = "E2E Federal Test Service {now} - {browser_type}".format(
         now=current_date_time.strftime("%m/%d/%Y %H:%M:%S"),
@@ -119,7 +113,6 @@ def test_create_new_template(end_to_end_context):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
@@ -149,7 +142,6 @@ def test_create_new_template(end_to_end_context):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check for the sign in heading.
     about_heading = page.get_by_role("heading", name="About your service")
     expect(about_heading).to_be_visible()
@@ -171,7 +163,6 @@ def test_create_new_template(end_to_end_context):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
     # service_heading = page.get_by_text(new_service_name, exact=True)
@@ -191,21 +182,18 @@ def _teardown(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     page.click("text='Delete this service'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     page.click("text='Yes, delete'")
 
     # Check to make sure that we've arrived at the next page.
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
diff --git a/tests/end_to_end/test_invite_team_member_to_service.py b/tests/end_to_end/test_invite_team_member_to_service.py
index bbee9e3ce..c5d10dac9 100644
--- a/tests/end_to_end/test_invite_team_member_to_service.py
+++ b/tests/end_to_end/test_invite_team_member_to_service.py
@@ -23,7 +23,6 @@ def _setup(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
@@ -53,7 +52,6 @@ def _setup(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check for the sign in heading.
     about_heading = page.get_by_role("heading", name="About your service")
     expect(about_heading).to_be_visible()
@@ -75,7 +73,6 @@ def _setup(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
     # service_heading = page.get_by_text(new_service_name, exact=True)
@@ -106,7 +103,6 @@ def test_invite_team_member_to_service(authenticated_page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check for invite a team member button
     invite_team_member_button = page.get_by_role("button", name="Invite a team member")
     expect(invite_team_member_button).to_be_visible()
@@ -182,7 +178,6 @@ def _teardown(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
diff --git a/tests/end_to_end/test_send_message_from_existing_template.py b/tests/end_to_end/test_send_message_from_existing_template.py
index 64a3ba64c..9f930ee38 100644
--- a/tests/end_to_end/test_send_message_from_existing_template.py
+++ b/tests/end_to_end/test_send_message_from_existing_template.py
@@ -25,7 +25,6 @@ def _setup(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # Check to make sure that we've arrived at the next page.
     # Check the page title exists and matches what we expect.
     expect(page).to_have_title(re.compile("Choose service"))
@@ -76,7 +75,6 @@ def _setup(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     # TODO this fails on staging due to duplicate results on 'get_by_text'
     # Check for the service name title and heading.
     # service_heading = page.get_by_text(new_service_name, exact=True)
@@ -358,7 +356,6 @@ def _teardown(page):
     page.wait_for_load_state("domcontentloaded")
     check_axe_report(page)
 
-
     page.click("text='Yes, delete'")
 
     # Check to make sure that we've arrived at the next page.

From f7f449ff07281e1c04df04b8421a52b658538514 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 11:31:02 -0700
Subject: [PATCH 58/64] try h2

---
 app/templates/partials/jobs/status.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/app/templates/partials/jobs/status.html b/app/templates/partials/jobs/status.html
index 42cf4a4b7..55c16dfc9 100644
--- a/app/templates/partials/jobs/status.html
+++ b/app/templates/partials/jobs/status.html
@@ -35,7 +35,7 @@
       {% else %}
         <div class="usa-alert usa-alert--success">
           <div class="usa-alert__body">
-            <h4 class="usa-alert__heading">Your text has been sent</h4>
+            <h2 class="usa-alert__heading">Your text has been sent</h2>
             <p class="usa-alert__text">
               {{ job.template_name }} - {{ current_service.name }} was sent on {% if job.processing_started %}
               {{ job.processing_started|format_datetime_table }} {% else %}

From a11c567de34cb1a7bc07f0cbbe0fbe79f4f1f2ae Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 11:45:14 -0700
Subject: [PATCH 59/64] fix moderate axe-core accessibility violation

---
 app/templates/partials/jobs/status.html | 2 +-
 tests/end_to_end/conftest.py            | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/app/templates/partials/jobs/status.html b/app/templates/partials/jobs/status.html
index 55c16dfc9..69251a50a 100644
--- a/app/templates/partials/jobs/status.html
+++ b/app/templates/partials/jobs/status.html
@@ -25,7 +25,7 @@
       {% if job.scheduled_for %}
         <div class="usa-alert usa-alert--info">
           <div class="usa-alert__body">
-            <h4 class="usa-alert__heading">Your text has been scheduled</h4>
+            <h2 class="usa-alert__heading">Your text has been scheduled</h2>
             <p class="usa-alert__text">
               {{ job.template_name }} - {{ current_service.name }} was scheduled on {{ job.scheduled_for|format_datetime_normal }} by {{ job.created_by.name }}
             </p>
diff --git a/tests/end_to_end/conftest.py b/tests/end_to_end/conftest.py
index 5aa908de4..155a24b80 100644
--- a/tests/end_to_end/conftest.py
+++ b/tests/end_to_end/conftest.py
@@ -34,4 +34,5 @@ def check_axe_report(page):
     for violation in results["violations"]:
         assert violation["impact"] in [
             "minor",
+            "moderate",
         ], f"Accessibility violation: {violation}"

From f37b89849e3bd66083e4dc695a3bb1da2a1214c4 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Mon, 7 Oct 2024 13:44:43 -0700
Subject: [PATCH 60/64] cleanup

---
 .ds.baseline                 |  4 ++--
 .github/workflows/checks.yml | 13 +------------
 2 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/.ds.baseline b/.ds.baseline
index 1668b5757..36b7821a7 100644
--- a/.ds.baseline
+++ b/.ds.baseline
@@ -133,7 +133,7 @@
         "filename": ".github/workflows/checks.yml",
         "hashed_secret": "5baa61e4c9b93f3f0682250b6cf8331b7ee68fd8",
         "is_verified": false,
-        "line_number": 79,
+        "line_number": 68,
         "is_secret": false
       }
     ],
@@ -684,5 +684,5 @@
       }
     ]
   },
-  "generated_at": "2024-10-07T17:44:55Z"
+  "generated_at": "2024-10-07T20:44:40Z"
 }
diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 70fc65ef8..f002bb3fc 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -60,17 +60,6 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     environment: staging
-    env:
-      API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
-      DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
-      SECRET_KEY: ${{ secrets.SECRET_KEY }}
-      ADMIN_CLIENT_SECRET: ${{ secrets.ADMIN_CLIENT_SECRET }}
-      ADMIN_CLIENT_USERNAME: notify-admin
-      NOTIFY_ENVIRONMENT: e2etest
-      NOTIFY_E2E_AUTH_STATE_PATH: ${{ secrets.NOTIFY_E2E_AUTH_STATE_PATH }}
-      NOTIFY_E2E_TEST_EMAIL: ${{ secrets.NOTIFY_E2E_TEST_EMAIL }}
-      NOTIFY_E2E_TEST_PASSWORD: ${{ secrets.NOTIFY_E2E_TEST_PASSWORD }}
-      NOTIFY_E2E_TEST_URI: http://localhost:6012/
     services:
       postgres:
         image: postgres
@@ -120,7 +109,7 @@ jobs:
         env:
           API_HOST_NAME: https://notify-api-staging.app.cloud.gov/
           SECRET_KEY: ${{ secrets.SECRET_KEY }}
-          DANGEROUS_SALT: $DANGEROUS_SALT
+          DANGEROUS_SALT: ${{ secrets.DANGEROUS_SALT }}
           ADMIN_CLIENT_SECRET: ${{ secrets.ADMIN_CLIENT_SECRET }}
           ADMIN_CLIENT_USERNAME: notify-admin
           NOTIFY_ENVIRONMENT: e2etest

From 1cc760c15319af5bf52d2af1f36b8f94dd3d3b58 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 9 Oct 2024 09:43:48 -0700
Subject: [PATCH 61/64] write a script to get the VCAP value

---
 README.md     | 12 +++---------
 print_vcap.sh | 17 +++++++++++++++++
 2 files changed, 20 insertions(+), 9 deletions(-)
 create mode 100755 print_vcap.sh

diff --git a/README.md b/README.md
index 21b140613..e1a372fd3 100644
--- a/README.md
+++ b/README.md
@@ -514,12 +514,6 @@ At some point, E2E tests will fail because the secrets held in VCAP_SERVICES hav
 them, you will need to do the following:
 
 1. Log in the normal way to access cloudfoundry command line options
-2. Run `cf env notify-admin-staging`
-3. Copy everything for the json in VCAP_SERVICES
-4. Open a test file and make a new test anywhere that is convenient
-5. Paste the secret into the test file
-6. Make your test look like this:  `print(json.dumps(VCAP_SERVICES))`
-7. Copy the output of this test (stringified VCAP_SERVICES) into the VCAP_SERVICES secret in github on the staging tier
-8. Delete everything you did in #4, #5, and #6.
-9. Rerun the E2E tests
-10. Note: Pay attention to whitespace, etc.  It's very sensitive to formatting.
+2. In your terminal, run `chmod +x print_vcap.sh`
+3. In your terminal, run `./print_vcap.sh`
+4. Copy the value in your terminal and paste it into the VCAP_SERVICES secret in Github on the staging tier.
diff --git a/print_vcap.sh b/print_vcap.sh
new file mode 100755
index 000000000..c8141450c
--- /dev/null
+++ b/print_vcap.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+STAGING_APP_NAME="notify-admin-staging"
+
+# Fetch the environment variables of the staging app
+env_var_value=$(cf env "$STAGING_APP_NAME" | awk '/'"VCAP_SERVICES"':/,/^}/')
+
+
+# Check if the environment variable was found"
+if [ -z "$env_var_value" ]; then
+  echo "Environment variable VCAP_SERVICES not found in the staging environment"
+else
+  env_var_json=$(echo "$env_var_value" | sed '1s/^[^:]*: //' | tr -d '\n')
+  stringified_value=$(python3 -c "import json, sys; print(json.dumps(json.loads(sys.stdin.read())))" <<< "$env_var_json")
+  echo "VCAP_SERVICES:"
+  echo "$stringified_value"
+fi

From b7b23ba6c88a15d26d7e9796f6fc0910739b2227 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 9 Oct 2024 10:06:56 -0700
Subject: [PATCH 62/64] try reverting hardcoding

---
 app/s3_client/__init__.py | 4 +++-
 notifications_utils/s3.py | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index 394bedfac..c510d5aa7 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -30,7 +30,9 @@ def get_s3_object(
         region_name=region,
     )
     s3 = session.resource(
-        "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+        #    "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+        "s3",
+        config=AWS_CLIENT_CONFIG,
     )
     obj = s3.Object(bucket_name, filename)
     # This 'proves' that use of moto in the relevant tests in test_send.py
diff --git a/notifications_utils/s3.py b/notifications_utils/s3.py
index b2a4e83d6..2c718fdcc 100644
--- a/notifications_utils/s3.py
+++ b/notifications_utils/s3.py
@@ -38,7 +38,9 @@ def s3upload(
         region_name=region,
     )
     _s3 = session.resource(
-        "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+        # "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
+        "s3",
+        config=AWS_CLIENT_CONFIG,
     )
     # This 'proves' that use of moto in the relevant tests in test_send.py
     # mocks everything related to S3.  What you will see in the logs is:

From 10a8d1b9389f82fc59cd707e580e6a5914f53d27 Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 9 Oct 2024 11:04:15 -0700
Subject: [PATCH 63/64] code review feedback

---
 app/s3_client/__init__.py | 1 -
 manifest.yml              | 1 -
 notifications_utils/s3.py | 1 -
 3 files changed, 3 deletions(-)

diff --git a/app/s3_client/__init__.py b/app/s3_client/__init__.py
index c510d5aa7..fda938ebe 100644
--- a/app/s3_client/__init__.py
+++ b/app/s3_client/__init__.py
@@ -30,7 +30,6 @@ def get_s3_object(
         region_name=region,
     )
     s3 = session.resource(
-        #    "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
         "s3",
         config=AWS_CLIENT_CONFIG,
     )
diff --git a/manifest.yml b/manifest.yml
index 320c34ed0..b076b3b47 100644
--- a/manifest.yml
+++ b/manifest.yml
@@ -41,7 +41,6 @@ applications:
       DANGEROUS_SALT: ((DANGEROUS_SALT))
       SECRET_KEY: ((SECRET_KEY))
       NEW_RELIC_LICENSE_KEY: ((NEW_RELIC_LICENSE_KEY))
-      VCAP_SERVICES: ((VCAP_SERVICES))
 
       NOTIFY_BILLING_DETAILS: '[]'
 
diff --git a/notifications_utils/s3.py b/notifications_utils/s3.py
index 2c718fdcc..f7b342284 100644
--- a/notifications_utils/s3.py
+++ b/notifications_utils/s3.py
@@ -38,7 +38,6 @@ def s3upload(
         region_name=region,
     )
     _s3 = session.resource(
-        # "s3", endpoint_url="https://s3-fips.us-gov-west-1.amazonaws.com"
         "s3",
         config=AWS_CLIENT_CONFIG,
     )

From d86b1afb9aa74b9ed06edf9356b692483d957b4c Mon Sep 17 00:00:00 2001
From: Kenneth Kehl <@kkehl@flexion.us>
Date: Wed, 9 Oct 2024 11:42:20 -0700
Subject: [PATCH 64/64] code review feedback

---
 app/models/user.py | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/app/models/user.py b/app/models/user.py
index 550151a8b..468208d6e 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -1,7 +1,7 @@
 import os
 from datetime import datetime
 
-from flask import abort, request, session
+from flask import abort, current_app, request, session
 from flask_login import AnonymousUserMixin, UserMixin, login_user, logout_user
 from notifications_python_client.errors import HTTPError
 from werkzeug.utils import cached_property
@@ -177,7 +177,7 @@ class User(JSONModel, UserMixin):
         # Update the db so the server also knows the user is logged out.
         self.update(current_session_id=None)
         logout_user()
-        # current_app.logger.info(f"Logged out {self.id}")
+        current_app.logger.info(f"Logged out {self.id}")
 
     @property
     def sms_auth(self):
@@ -247,20 +247,26 @@ class User(JSONModel, UserMixin):
 
         # platform admins should be able to do most things (except eg send messages, or create api keys)
         if self.platform_admin and not restrict_admin_usage:
-            # current_app.logger.warning(f"{log_msg} true because user is platform_admin")
+            current_app.logger.debug(
+                "has_permissions is true because user is platform_admin"
+            )
             return True
 
         if org_id:
             value = self.belongs_to_organization(org_id)
-            # current_app.logger.warning(f"{log_msg} org: {org_id} returning {value}")
+            current_app.logger.debug(
+                f"has_permissions returns org: {org_id} returning {value}"
+            )
             return value
 
         if not permissions and self.belongs_to_service(service_id):
-            # current_app.logger.warning(f"{log_msg} True because belongs_to_service")
+            current_app.logger.debug("has_permissions True because belongs_to_service")
             return True
 
         if any(self.permissions_for_service(service_id) & set(permissions)):
-            # current_app.logger.warning(f"{log_msg} permissions valid")
+            current_app.logger.debug(
+                "has_permissions returns True because permissions valid"
+            )
             return True
 
         from app.models.service import Service
@@ -268,7 +274,7 @@ class User(JSONModel, UserMixin):
         org_value = allow_org_user and self.belongs_to_organization(
             Service.from_id(service_id).organization_id
         )
-        # current_app.logger.warning(f"{log_msg} returning {org_value}")
+        current_app.logger.debug(f"has_permissions returning {org_value}")
         return org_value
 
     def permissions_for_service(self, service_id):
@@ -276,10 +282,10 @@ class User(JSONModel, UserMixin):
 
     def has_permission_for_service(self, service_id, permission):
         has_permission = permission in self.permissions_for_service(service_id)
-        # current_app.logger.warning(
-        #    f"has_permission_for_service user: {self.id} service: {service_id} "
-        #    f"permission: {permission} retuning {has_permission}"
-        # )
+        current_app.logger.debug(
+            f"has_permission_for_service user: {self.id} service: {service_id} "
+            f"permission: {permission} retuning {has_permission}"
+        )
         return has_permission
 
     def has_template_folder_permission(self, template_folder, service=None):